Overview
Arcus Media is a ransomware-as-a-service operation that the tracker says emerged in May 2024. It uses double extortion with ChaCha20 and RSA-2048 encryption and recruits affiliates through a referral-based vetting process. The tracker lists 118 victims in 41 countries, with Brazil (23) and the United States (16) the most frequent, across manufacturing, healthcare, retail, and business services. We hold little further public technical reporting on it.
- First tracked: 2024-05-15
- Discussed in our reports: Maghreb
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
Brazil23
United States of America16
Spain6
Colombia5
Mexico4
Canada4
France4
United Arab Emirates4
United Kingdom4
Italy4
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
None recorded in the sources we reviewed.
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| A r c u s | DLS | arcuufpr5xxbbkin4mlidt7itmr6znlppk63jbtkeguuhszmc5g7qdyd[.]onion | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11